PST2/PIWIS - Reading a Key Fob Code

Has anyone out there that has a PST2 tried to read the "code" out of a Key Fob that this not programmed into their car's security system? From my reading of the workshop manual, I think this is possible to do. Someone please correct me if I'm wrong. If it is possible, we should send a bunch of Key Fobs to someone with a PST2 so the Code's can be read out... Saving the cost of many new Fobs.

The guy doing my car couldn't do it or else I would've went the used key route instead of purchasing a new one. Of course "someone" may have a hack for it. Lol

I think the dealer can read the code out of a Key. They would rather sell you a new Key though.

Quotes source post: 13190400

My guy no longer works for the dealer and went indy so he doesn't have anything to lose from me. Got an answer back from him regarding this. When you press the key, the immobilizer receives the data from it and records it even though that key has never been paired with the immobilizer. This is done in key programming mode. It displays the last remote frequency received, HOWEVER, it only displays the first 6-8 characters only and not the entire key code. Because of this, you can't read the entire hex code of a used key and you must have the full code tag.

Thanks for tracking this down Alpine. I guess thats one avenue of getting a Code out of a Key that is dead. I'm still working on two other ways to potentially get the Code out of a Key. 1) Identify the chip in the Fob that holds the Code and use an eprom burner(reader) to get it out. 2) Piggyback (with a Logic Analyzer) on the lines (bus) that goto the Security Box and watch the code go by as it goes from the ignition to the security box in the car.

Ok this is how I would go about getting the code for a used key. Tools needed pst2 tester or piwis and some one with the "authority knowledge to do what is required" First when you have an instance when you need to replace alarm module on a p car the Porsche computer gives you the option to read out the old alarm module and store the information in the delves if the Porsche tester! When you put in a new alarm module it gives you the opportunity if you want to transfer said copied data into new module. A bit like when you copy and paste documents on PC Windows programme. Once you copied (read out the data from alarm module). The tricky bit starts you need to open up pst2 tester or piwis and remove the hard drive. Then you connect hard drive to a normal PC then read the files. Eventually you will come across the relevant folder which stores the read out data! Now you need to look at this data and figure out which line is the code line for the remote programming hex code. It helps if you read out a virgin module first which will also contain loads of software data but no extra lines for key codes as they have not been put on a virgin module as virgin module has basic software on it. Then compare both files the Virgin file and your existing file and you will notice a string of hex code which would be the encrypted code for your key. But the piwis software as a whole when running does not allow you access to the remote key code hence why the little white tag that comes with new keys is so important. Because you can re introduce your used key to any other P car and get the remote to latch on if you have the code that comes on the white tag. I feel Porsche should have put the hex code on a sticker inside the fob it would have saved a lot of hassle but they are in the game to make money, and selling keys and other parts is a huge side along new car sales.

Reminds me of the old days when we would open up the saved game files on our DOS machines in a hex to ascii reader to max out our gold and remaining lives. Never knew it had a real world application.

I always recommend people take pics of their tags and upload it to the cloud or email it to themselves on a cloud based email account just in case.

Thanks CBR. Thats a great idea. Unfortunately I don't have a PIWIS/PST2. Maybe someone out there who does have a PIWIS/PST2 would like to conduct a little experiment and give your method a try, or better yet, if they are in the SF Bay Area, I can come to them and try it. For the PC based version, can it work in a Mac Virtual PC (using Parallels)? If so, it seems that you would not need to take out the hard drive, you could just access the files from outside the Virtual PC.

Quotes source post: 13194427

Um, what you said makes sense if you can read the alarm module that the key has paired with. However, the OP does not have the alarm module. All he has is a random used key fob. Does it mean we can still apply your method but only after we do what Alpine mentioned in post #4?

It seems to me that if Alpine is right in post #4 (which I think is correct), any Alarm module can read any Key code, even if it is not paired. This makes sense to me as the Alarm module most likely reads any type of Key and then compares it to the ones that are Programed into the Alarm module as being valid for that particular car. It is interesting that the software only displays part of the Key code, I suspect that the software has the entire code internally but that the software was written so that it only Displays part of the code. I guess this is part of the "security" system. Otherwise, in theory, you could steal a Key, get its code out and then reproduce the code to open a particular car that one wanted to steal.

AHSAI I think I made a boo boo you are correct. I think I have only tried this method on a key that was already programmed to an alarm module but I wanted to find the original hex code for that key so that I could program it to another car. I did once program a remote key to my 996 turbo and 996 C4 which was funny it was a spare key for the remote part for both cars and when I pressed the key both cars locked and vice versa which was interesting. But if it is just a random key off eBay it might be a little difficult trying to find that elusive hex code. I was trying to find the hex code for a key which stopped working and I figured if I can try reprogram it to another car it will rule out if key is faulty or the alarm module or the attenna that picks up detects the incoming signal.

On a side note although I found it easy to pair the remote part of the key fob to two different p cars. I could not program the rfid glass pill that is the imobilizer part to both cars. It would only take to one p car at a time. If I knocked it off a p car alarm ECU then the same used pill would take to another p car. It was all fun and games I just guess I experimented on my own cars because I enjoyed wrenching and playing with cars in my garage. Hence the move over to air cooled stuff as they are older and require more attention to detail I can enjoy my hobby on my weekend rides.

Thanks for the clarification. Does sound like a lot of fun hacking the system and its components

old thread I know, Just did the glass pill immo coding, not the remote locks coding. 1. get a eprom reader, ezp2010 for 15 bucks works well. 2. take immo out of car, open it up and either clip on the SOIC or desolder the eprom and read it, verify it and save it. 3. get your FVDI or AVDI interface with Abrites and program a new Meagmos 48 pill or an old one that is not locked, the immo code is in the dump file you just created and abrites will read it out. 4. you can also go to an online service that decodes immo dumps and get the 3 byte code from the immo that way, I have tried both. you need win 7 computer for softwares to work Have not yet figured out how to get the 12 byte key code for the remote to be programmed, next project

Subscribed - I'm curious OP even if you did get the HEX code of a used key you'd still need your cars learning code to then program that key to your car. Or is that not a concern? Are we specifically talking gaining the HEX code of a used key just to have it? I have a PIWIS2 with a JAVA/programming/IT background so if you need anything done let me know I might be able to give it a shot.

It is the other way around, the method I described will give you the immo-code not the 12 byte hex code for key remote, only the 3 byte code to program the immo-chip that sits in the key that will let you start the car. The remote lock/unlock function requires the 12 byte hex code that comes on the key tags with a new key that nobody keeps since few original owners knew why they should have kept it. That code can be retrieved according to some people on forums, I don�t know how but I guess you need to read one of the 2 chips on the key head and from there decipher it, not done in a heartbeat unless you have the right software to do it.

Right, so we're talking about retrieving the immobiliser code/alarm unit so it can be reprogrammed into another car - not keys?

Quotes source post: 16463464

nope, the key gets programmed twice, once for the immo and once for the remote lock unlock function, so with the immo code you can make a key that will start the car but you will have to unlock the car by sticking the key into the door and turning the key. Not pushing the button. Programming a new immo into a car is a different excercise

Quotes source post: 16463800

Yes one program for the RFID chip (the "pill") and the other the circuit board to lock and unlock. So reading back to your original post the idea is reading the key lock/unlock HEX programming code? As the RFID pill is relatively inexpensive and replaceable? As such you can re-program a used key without its original swing tag? There was someone on here who was admit they could do it but wouldn't give any details on how it was done. Guess it was potentially their time figuring it out and may not want to give it up that easily.

Yes exactly. I am getting a new keyhead with the 12 byte code and a new pill and since I have the dump from the immo I can program it (both pill and remote) with my FVDI interface. I have piwis too but I don�t think I can program keys with it. I am also getting some new eproms so I will try and just swap the code from my working immo into a used immo from another car and see if that makes it compatible with my car instead of using the piwis.

Super interested in the R&D going on here. I also follow the DJI drone space closely, and the OG's there are constantly battling DJI engineers to jail-break the latest HW and FW from DJI. One development there that might be interesting here in the Porsche space is that those of us wanting to break the manufacturer's lock on our car/drone, contribute into a pool whereby the OG who finally cracks the code wins a bounty. In the DJI space, the factory contstraints that are jail-broken are max altitude, max speed, factory veto on where and when you fly, etc. The Porsche lock is simply a financial one: you can have a 2nd key, but it's going to cost you an absurd amount of money. Perhaps a variant on the DJI OG bounty program looks like this: Anders/OG cracks the code on the complete system, FOB entry, and car start. One of us confirms the solution (and pays Anders/OG for solving our 2nd key conundrum). Once safely verified by one of us (established rennlister with no prior connection to Anders/OG), then it's safe for others to pay $X for 2nd key solution. At some point, maybe Anders/OG says "I've made enough $$ on this, fee just dropped in half/quarter/eighth/etc." At that point, Porsche and its dealers would be smart to stop charging ridiculous dollars (or euros) for a factory 2nd key. Thoughts? Anders, if you have no interest in something like this, I would completely understand. We can recruit a 17yo hacker who would become the "996 Key OG". ;-) See screen shot of nolimitdronez.com . Note bounties on the right side panel, specific to different aircraft that have yet to be cracked ("rooted").

I think that the hacking has already been done, I have just used what is available out there and can be bought from specialized ECU repair for instance. But for the DIY/tinkerers that are looking at some sort of interface to hook up their cars and they want to make a key the described setup would enable that. I am not in the key-making business and frankly it makes no sense to do all this to get one key done. Some of us have several porsches and then it could make sense to be able to make keys but also trouble shoot the cars and therefore make the investment in tools and time. My description will cut down the learning time.

Hi folks, I'm in a real pickle and need help urgently with my 1999 model 996 tiptronic. I have searched the forum for answers, and I figured perhaps this thread might be a good place to start asking for help. I only had a single key that can start the car. I did buy and cut another key which can open the car door and free up the steering, but not able to start the car as I have yet to get it programmed (which was something I was about to do it this week). As Murphy's Law would have it, I lost the one and only key that I have to start the car! And to make matters worse, my car is parked at a friend's garage which is at the bottom of a steep slope with a very narrow single lane access featuring a 180 degree hairpin U-turn that will not allow me to get a tow truck in to bring it for programming. As a bonus thrown in, the car is sitting in a friend's garage because it has engine fault codes for misfiring, as well as likely being low on transmission oil (hard shifting when I drove it to him, and I knew it was leaking trans oil, albeit very slowly). He was meaning to help me with changing the ignition coils etc. In other words, I have a un-driveable 996, stuck in a tow truck un-reachable spot, with no key to start it. The year of 2021 just keeps giving ... sigh. The key which I have currently is Porsche original part and comes with a tag (it has bar code and bunch of numbers on it). As mentioned, it will open door and I can turn it & dashboard lights up, but can't start the car. I asked the dealership and independents around here, but everyone said I must bring the car to them. I am hoping there's someone who can somehow program the key I have using just the VIN ... is that possible at all? I would deeply appreciate any help on how to get out of this complete mess I've created for myself. Thanks very much in advance for any advice/ideas/solutions/leads.

First, a good towing company can put cradles under the wheels in order to turn the car around and make it towable. Second, it will have to go to a Porsche dealer. They can order a new key from Stuttgart with the VIN, proof of ownership, etc. Then empty out all the credit cards in your wallet, When they get the key it will need to be programmed to the car, and only a dealership can do it. Good luck (and never ever lose your key).

I posted in the thread how it is done, I have done it myself, you will need some special electronics tools to do it, cheaper to call specialized ECU repair in Florida, I have used them when my 928 computer crapped out and they fixed that within a week. https://www.ecudoctors.com/ I am not affiliated in any way with them and I am sure there are other businesses that perform the same service.

Sounds expensive ... ouch. Thanks.

Quotes source post: 17415935

Thanks for reply. Yes, I was reading your post, and trying digest it.

Buying the "tools" and learning yourself how to do it is slightly more expensive (not counting the hours of work needed to learn it) than getting help from the pros. But if you are a tinkerer and maybe have more than one porsche then it makes some sense to fork up the money and time. It is about 500USD to get the hardware and you already have the key with ID48 chip and HEX code for remote function so that is what you are looking at. Nothing major but still a pain in the behind. Once you know how it is done you can make yourself a couple of extra spare keys or help your friends. I am in Raleigh NC so not in your back yard, otherwise I could have helped. BR Anders

....and in the mean time keep looking for the key around the workshop the car is parked at. Search the pockets of what you were wearing the days after you had the key last. Check the places you've been since you had the key last. Good luck.

Hello ,I can read 24 character code from used remote control 996 986 , after is possible teach again each remote control again. For more info [email removed]

My thought - if you have figured out how to retrive the 40 digit key from used keys, then start buying keys on Ebay and selling with the number!

Hi. I tried to get in touch but the email is no longer available.

Quotes source post: 17823825

Hi. I tried to get in touch but the email is no longer available.

Quotes source post: 19329707

Same here. PM�d you as well. Email is bouncing back. thank you